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(57) Abstract: The system for providing information prescriptions enables medical professionals and other responsible entities to 
prescribe a set of information for the individual to review in order to obtain legally -valid authorization of the individual. This system 
maintains a time and date stamped log, that identifies: providers, other responsible entities, patients, the set of information prescribed 
for each patient, the purpose for which the prescribed set of information is used. The Information Prescription System also includes 
the capability to test the patient's understanding of the information and provides the patient with a mechanism to generate inquiries 
and to access additional information relating to the prescribed set of information. The Information Prescription System also provides 
the means for the patient to electronically sign a consent (authorization) to for treatment and for product (drug and/or medical device) 
usage. 
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SYSTEM FOR PROVIDING INFORMATION PRESCRIPTIONS 

Cross Reference to Related Applications 

This application is a continuation-in-part of U.S. Patent Application No: 
5 09/430,331 titled "System for Providing Dynamic Data Informed Consent To Provide 
Data Privacy and Security In Database Systems and in Networked Communications." 

Field of the Invention 
This system relates to the field of information delivery and, in particular, to a 
system for managing and tracking an individual's access to and retrieval of prescribed 
10 information, and for support of legally valid acknowledgment and attestation by the 
individual to the receipt and understanding of the information and agreement to the 
stipulations described in the information. 

Problem 

It is a problem in the field of information delivery to individuals to provide 

15 adequate and timely information to an individual as well as to ensure that the 
individual reads the information, understands its contents, has an opportunity to raise 
questions relating to the information provided, and have the questions answered. 
There are many environments in which this process is found including, but not limited 
to: organ donor agreements, real estate broker agreements, financing arrangements, 

20 medical and surgical procedure authorizations, on line software license agreements, 
and the like. In these situations, the individual is provided with a set of information 
which constitutes an "information prescription" in that the set of information is typically 
predetermined in scope and content, and the individual is requested to read and 
understand the information. The individual must then attest to receipt of the 

25 information and agreement to the terms and conditions contained therein. The 
information prescription may be prescribed to the individual as a condition precedent 
to receipt of goods, services, and the like from a provider or the individual may seek 
out the information prescription in order to access goods, services, and the like. 

Atypical example of this information prescription scenario is found in the field 

30 of medicine. There is a plethora of medical information available to patients in printed 
form and over the Internet, which medical information covers the entire spectrum of 
information relating to: medical and surgical procedures, illnesses, prescription drugs, 
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treatments, alternative medicine, medical practitioners, care facilities, insurance 
coverage, government programs, and the like. This wealth of information is presently 
not organized in any manner to enable a patient to access the information that they 
desire in a convenient manner. Therefore, this wealth of information is not being used 
5 by many of the patients who need this information. An ancillary problem is that 
physicians expend a significant amount of time and effort in patient education, having 
to distill the wealth of medical information into a coherent, focused and 
understandable presentation for each patient and relating to each medical issue of 
that patient. The provider (doctor or hospital), or other responsible professional or 

10 business entity, is held legally accountable for delivery of this information in a 
complete and consistent manner. Therefore, every provider or other responsible 
professional or business entity must obtain legally defensible informed consent from 
the patient before instituting treatment or administering certain drugs or medical 
devices, conducting clinical research, using sensitive personal patient data, collecting 

1 5 tissue or organs for donation or banking, or obtaining medical power-of-attorney or 
living wills, and the like. Not only is this task daunting, but the physician or other 
responsible entity is without an adequate audit trail to demonstrate that the information 
was not only provided to the patient but also understood by the patient. Thus, the 
traditional nature of medical practice is that the time spent by the physician in patient 

20 education is typically compressed into a portion of an office visit, where the patient 
arrives unprepared and leaves without having had adequate time to fully ponder the 
information that was provided, while the physician is unsure how much of the 
presentation of information was understood by the patient. This traditional information 
transfer process reduces the likelihood that the patient makes the effort to raise their 

25 questions with the physician in a follow up communication. This problem is often 
better addressed in the area of surgical procedures, where the patient is typically more 
prepared to understand the teaching provided by the surgeon, since the surgery is 
typically authorized after a number of prior physician visits and the repeated 
presentation of information during this series of meetings reduces the likelihood that 

30 the patient fails to understand at least the basic information that is presented. 
However, there is a lack of an effective audit trail to demonstrate that the patient was 
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provided with adequate information and the information that was provided was 
understood by the patient. A further aspect of this problem is that drug and medical 
device manufacturers are required to provide drug and medical device use information 
to their doctor customers in the form of printed materials that describe the proper 
5 usage of the drug (dose, frequency, mode of use) or medical device as well as known 
side effects, contraindications, warnings and the like. This printed information is 
typically included in the packaging with the drugs or devices. However, this 
information is rarely read by or presented to the patient and less frequently understood 
by the patient Therefore, the entire field of medical information delivery as it is 

1 0 presently constituted is grossly inadequate for the needs of all the parties involved. 
The effective rate of information transfer from the medical professionals to the patients 
is very low and the medical professionals do not presently have any reliable, 
consistent and incontrovertible mechanism to verify that the information was provided 
to the patient and was understood by the patient. 

15 These problems, articulated for the field of medical information delivery, are 

analogous to problems found in numerous other fields, where an important segment 
of the information delivery is the fact that the individual who receives the information 
understands the information and acquiesces to the terms and conditions associated 
with the transaction for which the information is relevant. There presently is no viable 

20 solution to these problems. 

Solution 

The above described problems are solved and a technical advance achieved 
by the present system for providing information prescriptions which ensures that the 
individual who receives the information understands the information and acquiesces 

25 to the terms and conditions associated with the transaction for which the information 
is relevant. In the field of medical information delivery, for example, this system for 
providing information prescriptions enables medical professionals to prescribe a set 
of information for the patient to review. The system for providing information 
prescriptions provides a data access transaction environment (including Data 

30 Informed Consent) in its entirety, in order to reduce the cost of providing relevant 
medical information to patients as well as to ensure that the prescribed information 
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was provided to the patient and this information was understood by the patient, 
Moreover, there presently is no method by which the patient can attest to the receipt 
of and understanding of the information prescribed by the provider or other 
responsible entity and agree to the recommendations of the provider or other 
5 responsible entity attendant to that information in a manner that cannot be repudiated. 
This system for providing information prescriptions maintains a time and date stamped 
log, that identifies: providers or other responsible entity, patients, the set of information 
prescribed for each patient, the purpose for which the prescribed set of information is 
used. The system for providing information prescriptions also provides for multimedia 

1 0 information content that is archived and versioned for future reference to assure the 
integrity of the transaction. The system for providing information prescriptions also 
includes the capability to test the patient's understanding of the information and 
provides the patient with a mechanism to generate inquiries and to access additional 
information relating to the prescribed set of information. The provider or other 

15 responsible entity is therefore able to utilize the resources available from many 
sources to provide the patient with relevant information in a timely and efficient 
manner. The system for providing information prescriptions also contains the 
mechanisms by which the patient can attest to the viewing and understanding of the 
information and to the acceptance of the providers treatment and product use 

20 recommendations such that the patient's consent is thereby informed and the 

attestation cannot be legally repudiated. Thus, the present system for providing 
information prescriptions introduces a new paradigm in the field of information delivery 
and the secure attestation by an individual to terms and conditions associated with a 
transaction related to the delivered information. 

25 Various means of securing the data are available, such as symmetric and 

asymmetric encryption key systems and protected lists. Various means of 
authentication of users are available, including digital signatures, passwords, 
biometrics and smart cards. In the present embodiment, the security of data is 
addressed through the means of a public key infrastructure and digital certificate 

30 issuance to authorized and authenticated users. Each transaction participant consists 
of a client company, care provider, other responsible entity, or information source that 
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holds a general Digital Certificate to authenticate that company, provider or 
information source. Each Digital Certificate bears a unique identifier to ensure that it 
can be tracked. Each Digital Certificate issued is accompanied by a set of 
requirements governing its use that are designed for compliance with regulations and 
5 the access limitations defined by the issuer. Each patient is authenticated and issued 
a Digital Certificate or other means of authentication to use in the generation of a 
Dynamic Data Informed Consent and for use in providing information to the patient 
and tracking the use of this information by the patient, and for logging, archiving and 
tracking patient sign-off for understanding of the information and for treatment and 

10 product use authorization. 

The medium for data transmission among the parties served by the system for 
providing information prescriptions is any electronic data communication system, such 
as: the Internet, Intranet, Virtual Private Network (VPN), Wide Area Network, and the 
like. The system for providing information prescriptions acts as a compliance 

15 clearinghouse for the data flow and maintains a log of patients, category of data, 
purpose for which the data is used, time and date stamped. The system for providing 
information prescriptions maintains the audit trail of all uses of data, together with 
audit analysis software to determine if any breach of the system 1 s authorization 

structure occurs. The system for providing information prescriptions supports and 
20 records transactions entailing legally valid authorization for treatment and product use 
based on receipt and understanding of the information. 

Brief Description of the Drawing 
Figures 1A & 1B illustrate in block diagram form the overall architecture of the 
system for providing information prescriptions and a typical environment in which it is 
25 operational; 

Figure 2 illustrates additional details of the data informed consent system; 

Figures 3 and 4 illustrate in flow diagram form the operation of the system for 
providing information prescriptions of Figures 1A & 1B in processing a typical 
transaction; and 

30 Figure 5 illustrates in block diagram form the structure of the Dynamic Data 

Informed Consent Domain. 



5 



WO 01/86479 PCT/US01/13868 

Detailed Description 

The system for providing information prescriptions (termed "Information 
Prescription System" herein) ensures that the individual who receives the information 
understands the information and acquiesces to the terms and conditions associated 
5 with the transaction for which the information is relevant. In the field of medical 
information delivery, for example, this system for providing information prescriptions 
enables medical professionals to verify that a prescribed set of information was 
provided to the patient and this information was understood by the patient. The 
Information Prescription System provides a data access transaction environment 

10 (including Data Informed Consent) in its entirety, in order to reduce the cost of 
providing relevant medical information to patients as well as to ensure that the 
information was provided to the patient and this information was understood by the 
patient. The example of a medical information delivery scenario is used herein to 
illustrate the concepts of the Information Prescription System but this example is not 

1 5 intended to limit the scope and applicability of the I nformation Prescription System to 
the multitude of other fields and analogous applications where this paradigm is also 
applicable. 

Figures 1 A & 1 B illustrate in block diagram form the overall architecture of the 
Information Prescription System 101 and a typical environment in which it is 

20 operational. In particular, the present Information Prescription System 101 is 
incorporated into a data storage and processing complex 100 that is connected to at 
least one communication medium CM (such as the Public Switched Telephone 
Network, or a wireless network, or the Internet, or other switched data network) to 
thereby enable individuals to obtain communication connections with the Information 

25 Prescription System 101. The data storage and processing system 1 00 on which the 
Information Prescription System 101 resides, includes: interactive web server WS1, 
communications and data router DR1, a plurality of servers S1-Sn which function to 
manage a plurality of databases and provide an interface to the Information 
Prescription System 101 and the Dynamic Data Informed Consent System 102. The 

30 Information Prescription System 101 includes various data management processes, 
some of which are described below. 

6 
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The individuals who access the Information Prescription System 101 are 
typically equipped with a personal computer, hand held computing device, cellular 
communication device, telephone station set or other data interface device, 
collectively termed "terminal equipment" Tl-Tn herein. Atypical terminal equipment 
5 T1 can be equipped with a processor PC, display device D, Web browser software 
AB, and one or more databases or data storage devices, such as database E which 
is used to store information retrieved from the sites served by the Internet and 
database F which stores programs used to operate the processor PC. The data 
communication connection between the individual's terminal equipment T1 and the 

10 Information Prescription System 101 can be via the Internet, using the well known 
personal computer modem and Internet browser technology available at the 
individual's terminal equipment T1 . The physical connection that supports this data 
communication connection is typically effected from individual's terminal equipment 
T1 through the Local Exchange Carrier LEC1 of the Public Switched Telephone 

1 5 Network (PSTN) to the Internet CM which is also connected thereto. The Internet CM 
is also connected to a Local Exchange Carrier LEC2 which serves the 
communications and data router DR1 of the Information Prescription System 101. 

In this environment, there are numerous other entities that can make use of the 
Information Prescription System 101 and its capabilities, or can be accessed by the 

20 Information Prescription System 101 as is described below. For example, providers 
are typically equipped with a provider communication system P that enables the 
provider to communicate with the data storage and processing complex 100 via the 
Internet CM. The provider communication system typically is equipped with a plurality 
of databases, such as database C, which may store information, and database D, 

25 which may store information for access by the individuals, such as educational scripts. 
This information may alternatively be incorporated, in whole or in part, into a stand- 
alone interactive teaching system (not shown). Similarly, there are a multitude of 
information vendors who maintain information repositories, illustrated in conceptual 
form in Figure 1 A as information vendor Web site IV. The information vendor Web site 

30 IV typically consists of a data router/server DR2, Web server software WS2 and a 
plurality of databases, such as database A for storing prescription drug data for 
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access by patients, and database B for storing access control software and data to 
enable the information vendor to authenticate a patient's right of access, create an 
information audit trail, and manage the information transaction. The information 
vendor Web site IV can optionally be equipped with one or more stand-alone 
5 interactive teaching systems (not shown). 

There is a plethora of medical information available to patients in printed form 
and over the Internet, which medical information covers the entire spectrum of 
information relating to: medical and surgical procedures, illnesses, prescription drugs, 
treatments, alternative medicine, medical practitioners, care facilities, insurance 

10 coverage, government programs, legal issues surrounding research and tissue and 
organ donation, and the like. This wealth of information is presently not organized in 
any manner to enable a patient to access the information that they desire in a 
convenient manner. Therefore, this wealth of information is not being used by many, 
of the patients who need this information. An ancillary problem is that physicians 

1 5 expend a significant amount of time and effort in patient education, having to distill the 
wealth of medical information into a coherent, focused and understandable 
presentation for each patient and relating to each medical issue of that patient. Not 
only is this task daunting, but the physician is without an adequate audit trail to 
demonstrate that the information was not only provided to the patient but also 

20 understood by the patient. Moreover, the physician or other responsible entity has no 
means to assure that the information presented to a patient over a network has been 
received, understood and accepted by the patient. Thus, the traditional nature of 
medical practice is that the time spent by the physician in patient education is typically 
compressed into a portion of an office visit, where the patient arrives unprepared and 

25 leaves without having had adequate time to fully ponder the information that was 
provided, while the physician is unsure how much of the presentation of information 
was understood by the patient, even if the patient has signed an informed consent 
attestation. This traditional information transfer process reduces the likelihood that the 
patient makes the effort to raise their questions with the physician in a follow up 

30 communication. This problem is only marginally better addressed in the area of 
surgical procedures, where the patient may be more prepared to understand the 
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teaching provided by the surgeon, since the surgery is typically authorized after a 
number of prior physician visits and the (assumed) repeated presentation of 
information during this series of meetings may reduces the likelihood that the patient 
fails to understand at least the basic information that is presented. However, there is 
5 a lack of an effective audit trail to demonstrate that the patient was provided with 
adequate information and the information that was provided was understood by the 
patient. A further aspect of this problem is that drug and medical device 
manufacturers are required to provide drug and medical device use information to 
their physician customers in the form of printed materials that describe the proper 

10 usage of the drug (dose, frequency, mode of use) or devices as well as known side 
effects, contraindications, warnings and the like. This printed information is typically 
included in the packaging with the drugs and is rarely presented to the patient and 
less frequently understood. Therefore, the entire field of medical information delivery 
as it is presently constituted is grossly inadequate for the needs of all the parties 

1 5 involved. The effective rate of information transfer from the medical professionals to 
the patients is very low and the medical professionals do not presently have any 
mechanism to verify that the information was provided to the patient or was 
understood by the patient. 
Definitions: 

20 Confidentiality - This comprises a secret communication with another party 

(trusted other). The confidential exchange of information implies that the information 
is exchanged or shared with the trusted other who is trusted to keep the information 
secret, i.e. the trusted other will not disclose the information to others. 

Privacy - This comprises the state of being free from unsanctioned intrusion. 

25 Privacy is often confused with security. Security implies safety from intrusion, while 
privacy invokes the ability of a person to avoid intrusion unless that person authorizes 
the intrusion. 

Security - This comprises the level to which data is safe from unauthorized use. 
Security requires mechanisms which protect the data from unauthorized use. The 
30 dynamic process of authorization or revocation of authorization via operation of a 
security mechanism is the exercise of privacy. 
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Data Informed Consent -The process by which a patient is informed about their 
rights under the law, and the responsibilities of parties who use their personalized 
information (General Advisory), as well as the manner in which their data is used, 
managed and protected (Specific Advisory). This process provides for interactive 
patient control of disclosure authorization and the revocation thereof (Dynamic 
Consent). In other words Data Informed Consent dictates what client companies 
(providers, payers, drug and device manufacturers, research organizations, e-health 
companies) can do with the patient's data - hence a two-way interaction: the present 
system informs the patient of the various options; patients consent to client companies 
accessing their data via the present system pursuant to the parameters specified by 
the patient. 

Clients - The term "client" is used to identify any of the class of providing health 
care businesses or other responsible entities that interact with the patient, such as: 
health care providers, product vendors, information vendors, e-health companies, 
payers, laboratories, research organizations, attorneys, data storage companies, and 
the like.. 

The components of the Information Prescription system include: 
A public key infrastructure (PKI) that provides robust encryption of all data 
routed through the Information Prescription system. Encryption modalities 
other than PKI may be employed to implement this function. 

Digital certificates to provide ongoing authentication of approved parties, 
and associated constraints on use and attestations provided by the parties to 
whom they are issued. Other means of authentication such as passwords, 
biometrics and smart cards may be used to implement this function. 

A data center and service center managed by a controlling entity to 
manage both the issuance of digital certificates to participants (client 
companies and patients), and the management of Data Informed Consent. 
While the example is focused on the use of electronic apparatus for data 
storage, data exchange, data security, and privacy, it is expected that portions of this 
system may entail the use of traditional paper-based forms and processes. This 
example is used due to its pertinence to the present needs of this industry and is 
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intended to be illustrative of the concepts embodied in the Information Prescription 
system and is not intended to limit the scope of the Information Prescription system 
as embodied in the claims appended hereto. 
Dynamic Data Informed Consent 
5 The Dynamic Data Informed Consent system 102 is cooperatively operative 

with, and may be part of, the Information Prescription System 101 and functions to 
interactively manage the information exchange with the patient and maintain a 
confidential audit trail of the information accesses and retrievals by the patient. This 
Dynamic Data Informed Consent system 102 is described in detail in the above-noted 

10 U.S. Patent Application titled "System for Providing Dynamic Data Informed Consent 
To Provide Data Privacy and Security In Database Systems and in Networked 
Communications," and the disclosure contained in that application is hereby 
incorporated into this application to the extent necessary to support this description. 
The general provisions that the Dynamic Data Informed Consent segment 102 

15 of the present Information Prescription System 101 typically includes the following: 

1 . ) There is a duty not to use or disclose information except as authorized by 
the patient, or as explicitly permitted by legislation or regulations. 

2. ) Clients are permitted to use the information only for purposes compatible 
with and directly related to the purposes for which the information was collected or 

20 received, or for which they are authorized to disclose the information. 

3. ) Clients are required to maintain reasonable and appropriate administrative, 
technical, and physical safeguards. 

a.) The Dynamic Data Informed Consent System 102 ensures the integrity and 
confidentiality of information; and 
25 b.) The Dynamic Data Informed Consent System 102 protects against any 

reasonably anticipated threats or hazards to the security or integrity of the information 
and unauthorized uses or disclosures of the information. 
Architecture of the Dynamic Data Informed Consent System 

Figure 2 illustrates additional details of the Dynamic Data Informed Consent 
30 System 102 in conceptual block diagram form to illustrate the functionality of this 
system. The Dynamic Data Informed Consent System 102 functions to regulate the 



WO 01/86479 PCTAJS01/13868 

exchange of proprietary patient specific data among the plurality of clients served by 
the Dynamic Data Informed Consent System 102. The Dynamic Data Informed 
Consent System 102, in a typical embodiment, itself comprises one or more servers 
221, 222 which interface the Dynamic Data Informed Consent System 102 to the 
5 various elements contained in the data storage and processing system 1 00. The 
Dynamic Data Informed Consent System 102 can be viewed as a plurality of 
components, which can be implemented as an integrated facility or portions thereof 
can be outsourced to other vendors. For example, the data storage function can 
optionally be implemented within Dynamic Data Informed Consent System 102 as an 

1 0 Information Management System (IMS1 ), and the Public Key Infrastructure (PKI) can 
optionally be implemented within Dynamic Data Informed Consent System 102. The 
Information Management System (IMS1) includes a data storage manager 251, 
administrator interface terminal 254 and its associated data storage devices 252, 253, 
which stores the proprietary patient specific data. The core element of the Dynamic 

15 Data Informed Consent System 102 is the dynamic Data Informed Consent 
Management system (DIC Management). The Public Key Infrastructure (PKI) 
comprises a subscriber manager 220 and a key management element 230, shared 
between the Data Informed Consent Management system (DIC Management) and the 
Public Key Infrastructure (PKI). in addition, the Public Key Infrastructure (PKI) 

20 includes a digital certificate processing element 240. 

The Data Informed Consent Management system (DIC Management) typically 
comprises one or more servers 221 , 222 to manage interactions with patients and 
clients. The Data Informed Consent Management system (DIC Management) includes 
a patient/client subscription module comprising the RA Control Center 225, an 

25 associated administrator data terminal device 226 and data storage elements 227. 
Similarly, a digital certificate module, comprising the CA Control Center 223, an 
associated administrator data terminal device 224 and data storage elements 228, is 
provided. Finally, the Data Informed Consent Management system (DIC 
Management) includes a data informed consent module 260, comprising DIC Control 

30 Center 261 , an associated administrator data terminal device 262 and data storage 
elements 263, 264. The operation of these elements is described below. 
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Dynamic Data Informed Consent Transaction 

For clients and patients to be served by the Dynamic Data Informed Consent 
System 102, their identity must be verified and ensured in future transactions. This 
is typically accomplished by use of the well known paradigm of Digital Certificates. 
5 When a patient or client wishes to avail themselves of the services of the Dynamic 
Data Informed Consent System 102, they establish a communication connection via 
data communication medium CM to the Dynamic Data Informed Consent System 1 02 
and interconnect with servers 221 , 222 via communication paths WA. The Dynamic 
Data Informed Consent System 1 02 then executes a script via RA Control Center 225 

10 and certificate processing system 240, to identify the patient/client and record their 
identity and set of permissions in the registration database stored in memory 227. 
The Dynamic Data Informed Consent System 102 in well known fashion issues a 
Digital Certificate via certificate processing system 240, which Digital Certificate is 
transmitted via servers 221 , 222 and communication paths WA to the patient/client 

15 to thereby authorize future access to the Dynamic Data Informed Consent System 
102. 

When Digital Certificates are issued by the Dynamic Data Informed Consent 
System 102 to clients, these parties can access the Dynamic Data Informed Consent 
System 1 02 to assure compliance with a patient's dynamic data informed consent 

20 when accessing patients' proprietary patient specific data and providing data to 
patients. The patients are also provided with Digital Certificates, which they use to 
access the Dynamic Data Informed Consent System 1 02 to create the Data Informed 
Consent for the patient's personal data. Thus, the patient, via data communication 
medium 201, accesses the Dynamic Data Informed Consent System 102 and, in 

25 particular, the Data Informed Consent module 260 to create a Data Informed Consent 
file for the patient's proprietary patient specific data which is stored in informed 
consent database memory 263. This data informed consent data created by the 
patient is the basis of empowering the clients to access, exchange and process the 
patients' proprietary patient specific data. It is apparent that the patient can create the 

30 data informed consent data via the submission of a paper form, which is then input 
into the Dynamic Data Informed Consent System 1 02 by clerical staff. In either case, 
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the data informed consent stored in Dynamic Data Informed Consent System 102 is 

the basis for the transactions described herein. 

Domain Definition for the Dynamic Data Informed Consent System 

Figure 5 illustrates in block diagram form the structure of the Dynamic Data 
5 Informed Consent Domain. In particular, the correspondence among the various data 
elements in the Dynamic Data Informed Consent System 102 is illustrated. Thus, the 
patient has a one to one mapping to a Data Informed Consent, since the Dynamic 
Data Informed Consent System 102 maintains a single Data Informed Consent for 
each patient. The Data Informed Consent is mapped to up to n clients, although at 

10 any time there may be no clients authorized under the patient's Data Informed 
Consent. Similarly, the patient has a one to one correspondence to an audit trail file 
maintained by the Dynamic Data Informed Consent System 102. The audit trail file 
is mapped to up to n Data Informed Consent Updates, although at any time there may 
be no Data Informed Consent Updates authorized under the patient's Data Informed 

15 Consent. The Data Informed Consent Updates are mapped to up to n clients, 
although at any time there may be no clients authorized under the patient's Data 
Informed Consent Updates. The patient's audit trail file is mapped to up to n Health 
Information Transactions, although at any time there may be no Health Information 
Transactions authorized under the patient's Data Informed Consent. Similarly, each 

20 Health Information Transaction is mapped to up to n transmitting and n receiving 
clients, although at any time there may be no clients authorized under the patient's 
Data Informed Consent. 

Operation of the Information Prescription System 

Figures 3 and 4 illustrate in flow diagram form the operation of the Information 
25 Prescription System 1 01 of Figures 1 A & 1 B in processing a typical transaction. When 
Digital Certificates are issued to clients, these parties can access the Information 
Prescription System 101 to assure compliance when transacting with or accessing the 
Information Prescription System 101. The patients are also provided with Digital 
Certificates, which they use to access the Information Prescription System 101 to 
30 create the Data Informed Consent for the patient's data and for the access of 
information, with the associated audit trail creation. Thus, the patient accesses the 
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Information Prescription System 101 and, in particular, the Data Informed Consent 
Management module 201 to create a Data Informed Consent file for the patient's 
personal data which is stored in memory in one or more data storage systems, such 
as a rules-driven relational database system. 
5 In a typical interaction, the provider at step 301 instructs the patient to retrieve 

a predetermined set of information ("information prescription") for review prior to a 
conference scheduled between the patient and the provider. The information can 
reside in a single location or can be distributed across many locations. For example, 
an initial segment of the information prescription may reside on the provider's 

10 information system P, a second segment may reside on the data storage and 
processing system 100, and a third segment may reside on an information vendor 
information system IV. The issuance of an information prescription can be 
implemented electronically at step 302 by the provider, using provider information 
system P, encrypting the patient personal data, using PKI software and interface 

1 5 supplied by the company (PrivaComp, Inc.) that operates the Information Prescription 
System 101. The provider's Digital Certificate, issued by the Information Prescription 
System 101 , at step 303 is attached and the "wrapped" data is sent through the PKI 
encryption module 203 to ensure security of the transaction. The data access request 
flows to the Information Prescription System 101 Certificate Authority and Certificate 

20 Management module 202 at step 304 where the authorization of the provider is 
verified, as a client of the Information Prescription System 101 . The verified request 
is then forwarded to Data Informed Consent module 201 at step 305 to be processed 
and the granted request is output through PKI encryption module 203 and transmitted 
over the data transmission medium 1 03 at step 306 to the patient's terminal device T1 

25 to thereby enable the patient to execute the information prescription issued by the 
provider. All transactions, once cleared through the Certificate/signature validation 
step 304, result in the Information Prescription System 101 generating appropriate 
audit log entries. Thus, the information prescription is self defining, in that it identifies 
the patient and all segments of information (and optionally their sources) that are to 

30 be retrieved by the patient. The information prescription can optionally also establish 
thresholds for each segment of the information, where the threshold defines the 
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required minimum patient comprehension level for the received information, as 
measured by the entity providing the information. An additional optional feature of 
this process is executed at step 307 where the Information Prescription System 101 
generates a Digital Certificate, which is transmitted over the data transmission medium 
5 1 03 to client information vendor(s) IV who may then process the patient personal data 
transmitted by the provider and/or the Information Prescription System 101 to enable 
the patient to access data stored in the information vendor system IV. 

Once the patient has received the information prescription and the associated 
Digital Certificate, they can initiate the information retrieval process. At step 401 , the 

1 0 patient receives an information prescription from the Information Prescription System 
101 via the Internet CM at their terminal device T1. Alternatively, in some 
applications, the patient (or other individual) may initiate an information access 
independent of the provider. Such a case can be the retrieval of information to initiate 
an organ donor process. In either case, the patient then initiates a communication 

1 5 connection at step 402 to the Information Prescription System 101 via the Internet (as 
described above) in well known manner using terminal device T1 . At step 403, the 
Information Prescription System 101 receives the information prescription from the 
patient and verifies the authenticity of the information prescription via the operation of 
the Dynamic Data Informed Consent System 102, as described above. Once the 

20 information prescription has been validated and the audit trail file of this transaction 
created in database H, the Information Prescription System 101 at step 404, for 
example, provides the patient with access to a predetermined set of information that 
is stored in database G, which information constitutes a portion of the information 
defined in the information prescription. At step 405, the patient's access of this 

25 information and, optionally, the test results obtained via queries provided to the patient 
as part of the information retrieval process, are time stamped and recorded in a 
transaction file in database H to thereby provide an audit trail for future reference. 
Once the patient has completed their access of this segment (if there is such a 
segment in this transaction) of the information prescription, the Information 

30 Prescription System 101 at step 406 routes the patient to the repository of the next 
segment of the information contained in the information prescription, if there is another 
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segment. If not, the patient is routed to step 412 as described below. 

For example, the information vendor's information system IV can be accessed 
via the URL of this Web site, so the patient is automatically provided with the next 
portion of the information defined in the information prescription. The access to the 
5 information vendor Web site IV is accomplished by the Information Prescription 
System 101 at step 407 transmitting an information access request to the information 
vendor Web site IV in encrypted form as described above, including the Digital 
Certificate that was issued to the patient. At step 408, the information vendor Web 
site IV processes the information request by validating the permission of the patient 

10 to retrieve the identified information, then provides the patient with access to this 
information and creates an audit trail of the information access and, optionally, the test 
results obtained via queries provided to the patient as part of the information retrieval 
process. The information retrieval process data is time stamped and recorded in a 
transaction file in database B at step 409 to thereby provide an audit trail for future 

15 reference. In addition, the audit trail data, including identification of the patient, the 
data accesses and test results, are transmitted to the Information Prescription System 
101 at step 410 for storage in the transaction file associated with this patient at step 
41 1 . Upon completion of distribution of the information to the patient, at Step 41 2 the 
Information Prescription System 1 01 obtains a digital signature sign-off by the patient, 

20 that cannot be repudiated, confirming patient understanding of the information and 
agreement to physician-recommended treatment and product use, or other 
responsible entity-recommended authorization. Upon the conclusion of all of the 
information accesses defined in the information prescription, or upon termination of 
the session by the patient, the Information Prescription System 101 at step 413 

25 transmits an encrypted message to the provider's (or other responsible entities) 
information system P to advise the provider or other responsible entity of the patient's 
use of the information prescription, and whether the patient has executed the entirety 
of the information prescription. 

In this manner, the provider or other responsible entity can make use of 

30 resources available from many sources to provide the patient with information relating 
to a particular illness or medical condition or related transaction. The provider or other 
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responsible entity exercises control over the nature and content of the information by 
defining the information content of the information prescription, receives verification 
of the patient's use (in whole or in part) of the information prescription, and receives 
legally-valid, patient consent (authorization) that cannot be repudiated, for 
5 recommended treatment and/or product use, or other legally-required authorization 
in accordance with the information provided (i.e., legally defensible "informed 
consent"). The Information Prescription System 101 may remain connected to the 

patient's terminal device T1 for the entirety of the communication connection in order 
that the Information Prescription System 101 monitor the transaction and record the 

10 data relating to the patient's access of the information contained in the information 
prescription. Alternatively, the Information Prescription System 101 can facilitate the 
transfer of the data communication connection to an information vendor and simply 
receive data from the information vendor relating to the patient's access of the 
information contained in the information prescription. In either case, the Information 

1 5 Prescription System 101 maintains a record of the information prescription and its use 
for future validation of the patient's access to the information contained in the 
information prescription. 
Summary 

The Information Prescription System is a dynamic patient authorization 
20 management tool that differs from existing data management systems in that it 
enables medical professionals or other responsible entities to prescribe a set of 
information for the patient to review. The Information Prescription System provides 
a data access transaction environment (including Data Informed Consent) in its 
entirety, in order to reduce the cost of providing relevant medical and related 
25 information to patients as well as to ensure that the prescribed information was 
provided to the patient and that this information was understood by the patient and 
that the recommendations were accepted by the patient. 
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1 . A system for providing information prescriptions, operational in a data 
communication network which serves a plurality of providers, other responsible 

5 entities, and information vendors, where said system for providing information 
prescriptions is accessible by a plurality of individuals, said system for providing 
information prescriptions comprising: 

means, responsive to receipt of a request from a provider that defines both a 
set of information and a individual, for verifying authorization of said provider to issue 
10 an information prescription; and 

means for generating an information prescription that defines said set of 
information and identifies said individual. 

2. The system for providing information prescriptions of claim 1 further 
15 comprising: 

means for transmitting said information prescription to said individual. 

3. The system for providing information prescriptions of claim 2 wherein 
said means for generating comprises: 

20 means for identifying at least one information vendor to provide said individual 

with access to said set of information. 

4. The system for providing information prescriptions of claim 3 wherein 
said means for generating further comprises: 

25 means for transmitting said information prescription to said identified at least 

one information vendor. 

5. The system for providing information prescriptions of claim 4 further 
comprising: 

30 means, located at said identified at least one information vendor and 

responsive to said individual accessing said identified at least one information vendor 
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via said data communication network, for authenticating said individual by comparing 
an information prescription received from said means for transmitting with an identity 
of said individual; and 

means, responsive to said individual being authenticated, for providing said 
5 individual with access to at least a portion of said set of information. 

6. The system for providing information prescriptions of claim 5 further 
comprising: 

means, located at said identified at least one information vendor, for monitoring 
1 0 access of said individual to said at least a portion of said set of information; and 

means, located at said identified at least one information vendor, for generating 
an audit trail record of said information access, said audit trail record including at least 
one of: individual identification, information prescription identification, time stamp of 
said information access, duration of said information access, results of tests provided 
15 to said individual as part of said information access, degree of completion of said 
information access, digital signature sign-off by the individual confirming individual 
understanding of the information and agreement to stipulations contained in said 
information. 

20 7. The system for providing information prescriptions of claim 6 further 

comprising: 

means, located at said identified at least one information vendor, for 
transmitting said audit trail record to said means for generating to indicate said 
individual accessing said at least a portion of said set of information. 

25 

8. The system for providing information prescriptions of claim 7 further 
comprising: 

means for storing a received audit trail record in a memory. 

30 9. The system for providing information prescriptions of claim 8 further 

comprising: 
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means for transmitting data to said provider indicative of receipt of said audit 
trail record for said individual. 



10. The system for providing information prescriptions of claim 1 further 
5 comprising: 

means, responsive to said individual accessing said system for providing 
information prescriptions via said data communication network, for authenticating said 
individual by comparing said generated information prescription with an identity of said 
individual; and 

10 means, responsive to said individual being authenticated, for providing said 

individual with access to at least a portion of said set of information. 

11. The system for providing information prescriptions of claim 10 further 
comprising: 

1 5 means for monitoring access of said individual to said at least a portion of said 

set of information; 

means for generating an audit trail record of said information access, said audit 
trail record including at least one of: individual identification, information prescription 
identification, time stamp of said information access, duration of said information 
20 access, results of tests provided to said individual as part of said information access, 
degree of completion of said information access; and 

means for storing said audit trail record in a memory. 

12. The system for providing information prescriptions of claim 1 1 further 
25 comprising: 

means for transmitting data to said provider indicative of generation of said 
audit trail record for said individual. 

13. The system for providing information prescriptions of claim 1 1 further 
30 comprising: 

means for obtaining a digital signature sign-off by the individual, that cannot be 
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repudiated, confirming individual understanding of the information and agreement to 
stipulations contained in said information; and 

means for storing said digital signature in said memory. 

5 14. The system for providing information prescriptions of claim 13 further 

comprising: 

means for transmitting data to said provider indicative of generation of said 
audit trail record and said digital signature for said individual. 

10 15. The system for providing information prescriptions of claim 1 1 wherein 

said means for generating comprises: 

means for identifying at least one information vendor to provide said individual 
with access to at least a portion of said set of information. 

15 16. The system for providing information prescriptions of claim 15 further 

comprising: 

means, located at said identified at least one information vendor and 
responsive to said individual accessing said identified at least one information vendor 
via said data communication network, for authenticating said individual by comparing 
20 an information prescription received from said means for transmitting with an identity 
of said individual; and 

means, responsive to said individual being authenticated, for providing said 
individual with access to at least a portion of said set of information. 

25 17. The system for providing information prescriptions of claim 16 further 

comprising: 

means, located at said identified at least one information vendor, for monitoring 
access of said individual to said at least a portion of said set of information; and 

means, located at said identified at least one information vendor, for generating 
30 an audit trail record of said information access, said audit trail record including at least 
one of: individual identification, information prescription identification, time stamp of 
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said information access, duration of said information access, results of tests provided 
to said individual as part of said information access, degree of completion of said 
information access. 

5 18. The system for providing information prescriptions of claim 17 further 

comprising: 

means, located at said identified at least one information vendor, for 
transmitting said audit trail record to said means for generating to indicate said 
individual accessing said at least a portion of said set of information. 

10 

1 9. The system for providing information prescriptions of claim 1 8 wherein 
said means for storing is responsive to a received audit trail record for storing said 
received audit trail record in said memory. 

15 20. The system for providing information prescriptions of claim 19 further 

comprising: 

means for transmitting data to said provider indicative of receipt of said audit 
trail record for said individual. 

20 21. The system for providing information prescriptions of claim 19 further 

comprising: 

means for obtaining a digital signature sign-off by the individual, that cannot be 
repudiated, confirming individual understanding of the information and agreement to 
stipulations contained in said information; and 
25 means for storing said digital signature in said memory. 

22. The system for providing information prescriptions of claim 21 further 
comprising: 

means for transmitting data to said provider indicative of generation of said 
30 audit trail record and said digital signature for said individual. 
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23. A method of operating a system for providing information prescriptions, 
operational in a data communication network which serves a plurality of providers and 
information vendors, where said system for providing information prescriptions is 
accessible by a plurality of individuals, said system for providing information 
prescriptions comprising the steps of: 

verifying, in response to receipt of a request from a provider that defines both 
a set of information and a individual, authorization of said provider to issue an 
information prescription; and 

generating an information prescription that defines said set of information and 
identifies said individual. 

24. The method of operating a system for providing information prescriptions 
of claim 23 further comprising the step of: 

transmitting said information prescription to said individual. 

25. The method of operating a system for providing information prescriptions 
of claim 24 wherein said step of generating comprises: 

identifying at least one information vendor to provide said individual with access 
to said set of information. 

26. The method of operating a system for providing information prescriptions 
of claim 25 wherein said step of generating further comprises: 

transmitting said information prescription to said identified at least one 
information vendor. 

27. The method of operating a system for providing information prescriptions 
of claim 26 further comprising the steps of: 

authenticating at said identified at least one information vendor and in response 
to said individual accessing said identified at least one information vendor via said 
data communication network, said individual by comparing an information prescription 
received in said step of transmitting with an identity of said individual; and 
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providing, in response to said individual being authenticated, said individual 
with access to at least a portion of said set of information. 



28. The method of operating a system for providing information prescriptions 
5 of claim 27 further comprising the steps of: 

monitoring at said identified at least one information vendor, access of said 
individual to said at least a portion of said set of information; and 

generating at said identified at least one information vendor, an audit trail 
record of said information access, said audit trail record including at least one of: 
10 individual identification, information prescription identification, time stamp of said 
information access, duration of said information access, results of tests provided to 
said individual as part of said information access, degree of completion of said 
information access, digital signature sign-off by the individual confirming individual 
understanding of the information and agreement to stipulations contained in said 
15 information. 



29. The method of operating a system for providing information prescriptions 
of claim 28 further comprising the step of: 

transmitting from said identified at least one information vendor, said audit trail 
20 record to said system for providing information prescriptions to indicate said individual 
accessing said at least a portion of said set of information. 



30. The method of operating a system for providing information prescriptions 
of claim 29 further comprising the step of: 
25 system for providing information prescriptions storing a received audit trail 

record in a memory. 



31 . The method of operating a system for providing information prescriptions 
of claim 30 further comprising: 
30 transmitting data to said provider indicative of receipt of said audit trail record 

for said individual. 
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32. The method of operating a system for providing information prescriptions 
of claim 23 further comprising the steps of: 

authenticating, in response to said individual accessing said system for 
providing information prescriptions via said data communication network, said 
5 individual by comparing said generated information prescription with an identity of said 
individual; and 

providing , in response to said individual being authenticated, said individual 
with access to at least a portion of said set of information. 

1 0 33. The method of operating a system for providing information prescriptions 

of claim 32 further comprising the steps of: 

monitoring access of said individual to said at least a portion of said set of 
information; 

generating an audit trail record of said information access, said audit trail record 
1 5 including at least one of: individual identification, information prescription identification, 
time stamp of said information access, duration of said information access, results of 
tests provided to said individual as part of said information access, degree of 
completion of said information access; and 

storing said audit trail record in a memory. 

20 

34. The method of operating a system for providing information prescriptions 
of claim 33 further comprising the step of: 

transmitting data to said provider indicative of generation of said audit trail 
record for said individual. 

25 

35. The method of operating a system for providing information prescriptions 
of claim 33 further comprising the steps of: 

obtaining a digital signature sign-off by the individual, that cannot be 
repudiated, confirming individual understanding of the information and agreement to 
30 stipulations contained in said information; and 

storing said digital signature in said memory. 
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36. The method of operating a system for providing information prescriptions 
of claim 35 further comprising the step of: 

transmitting data to said provider indicative of generation of said audit trail 
record and said digital signature for said individual. 

5 

37. The method of operating a system for providing information prescriptions 
of claim 33 wherein said step of generating comprises: 

identifying at least one information vendor to provide said individual with access 
to at least a portion of said set of information. 

10 

38. The method of operating a system for providing information prescriptions 
of claim 37 further comprising the steps of: 

authenticating at said identified at least one information vendor and responsive 
to said individual accessing said identified at least one information vendor via said 
1 5 data communication network, said individual by comparing an information prescription 
received from said means for transmitting with an identity of said individual; and 

providing, in response to said individual being authenticated, said individual 
with access to at least a portion of said set of information. 

20 39. The method of operating a system for providing information prescriptions 

of claim 38 further comprising the steps of: 

monitoring at said identified at least one information vendor, access of said 
individual to said at least a portion of said set of information; and 

generating at said identified at least one information vendor, an audit trail 

25 record of said information access, said audit trail record including at least one of: 
individual identification, information prescription identification, time stamp of said 
information access, duration of said information access, results of tests provided to 
said individual as part of said information access, degree of completion of said 
information access. 

30 

40. The method of operating a system for providing information prescriptions 
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of claim 39 further comprising the step of: 

transmitting from said identified at least one information vendor, said audit trail 
record to said system for providing information prescriptions to indicate said individual 
accessing said at least a portion of said set of information. 

5 

41 . The method of operating a system for providing information prescriptions 
of claim 40 wherein said step of storing is responsive to a received audit trail record 
for storing said received audit trail record in said memory. 

1 0 42. The method of operating a system for providing information prescriptions 

of claim 41 further comprising the step of: 

transmitting data to said provider indicative of receipt of said audit trail record 
for said individual. 

1 5 43. The method of operating a system for providing information prescriptions 

of claim 41 further comprising the steps of: 

obtaining a digital signature sign-off by the individual, that cannot be 

repudiated, confirming individual understanding of the information and agreement to 

stipulations contained in said information; and 
20 storing said digital signature in said memory. 

44. The method of operating a system for providing information prescriptions 
of claim 43 further comprising the step of: 

transmitting data to said provider indicative of generation of said audit trail 
25 record and said digital signature for said individual. 

45. A system for providing information prescriptions, operational in a data 
communication network which serves a plurality of individuals and information 
vendors, where said system for providing information prescriptions is accessible by 

30 a plurality of individuals, said system for providing information prescriptions 
comprising: 
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means, responsive to receipt of a request from a provider or other responsible 
entity that defines a set of information, for verifying authorization of said provider to 
issue an information prescription; and 

means for generating an information prescription that defines said set of 
5 information. 



46. The system for providing information prescriptions of claim 45 further 
comprising: 

means, responsive to said individual accessing said system for providing 
10 information prescriptions via said data communication network, for authenticating said 
individual; and 

means, responsive to said individual being authenticated, for providing said 
individual with access to at least a portion of said set of information. 



15 47. The system for providing information prescriptions of claim 46 further 

comprising: 

means for monitoring access of said individual to said at least a portion of said 
set of information; 

means for generating an audit trail record of said information access, said audit 
20 trail record including at least one of: individual identification, information prescription 
identification, time stamp of said information access, duration of said information 
access, results of tests provided to said individual as part of said information access, 
degree of completion of said information access; and 

means for storing said audit trail record in a memory. 

25 

48. The system for providing information prescriptions of claim 47 further 
comprising: 

means for obtaining a digital signature sign-off by the individual, that cannot be 
repudiated, confirming individual understanding of the information and agreement to 
30 stipulations contained in said set of information; and 

means for storing said digital signature in said memory. 
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49. The system for providing information prescriptions of claim 48 further 
comprising: 

means for transmitting data to said provider indicative of generation of said 
audit trail record and said digital signature for said individual. 

5 

50. A method of operating a system for providing information prescriptions, 
operational in a data communication network which serves a plurality of individuals 
and information vendors, where said system for providing information prescriptions is 
accessible by a plurality of individuals, saidmethod of operating a system for providing 

10 information prescriptions comprising the steps of: 

verifying, in response to receipt of a request from a provider that defines a set 
of information, authorization of said provider to issue an information prescription; and 
generating an information prescription that defines said set of information. 

15 51 . The method of operating a system for providing information prescriptions 

of claim 50 further comprising the steps of: 

authenticating, in response to said individual accessing said system for 
providing information prescriptions via said data communication network, said 
individual; and 

20 providing, in response to said individual being authenticated, said individual 

with access to at least a portion of said set of information. 

52. The method of operating a system for providing information prescriptions 
of claim 51 further comprising the steps of: 
25 monitoring access of said individual to said at least a portion of said set of 

information; 

generating an audit trail record of said information access, said audit trail record 
including at least one of: individual identification, information prescription identification, 
time stamp of said information access, duration of said information access, results of 
30 tests provided to said individual as part of said information access, degree of 
completion of said information access; and 
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53. The method of operating a system for providing information prescriptions 
of claim 52 further comprising the steps of: 

obtaining a digital signature sign-off by the individual, that cannot be 
repudiated, confirming individual understanding of the information and agreement to 
stipulations contained in said set of information; and 

storing said digital signature in said memory. 

54. The method of operating a system for providing information prescriptions 
of claim 53 further comprising the step of: 

transmitting data to said provider indicative of generation of said audit trail 
record and said digital signature for said individual. 
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FIG. 3 
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FIG. 4 A 
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FIG. 4B 
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